{"id":"GHSA-3jxw-vj8m-8x77","kind":"vulnerability","aliases":["GHSA-3jxw-vj8m-8x77"],"related":[],"title":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server","description":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\n### CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\nBulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT\n\nDescription:\n\nAWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.\n\nWe identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nWe identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nImpacted versions:\n\n- <=1.0.0\n- >=0.1.0 AND <=0.1.5\n\nResolution:\n\nThis issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nUpgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.\n\nReferences:\n\n- CVE-2026-87912\n- CVE-2026-87913\n- GHSA-2px6-hhjp-3g5x\n- GHSA-3jxw-vj8m-8x77\n\nAcknowledgement:\n\nWe would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The AWS Security Agent plugin for aws-agents-for-devsecops (before 1.1.0) and its MCP server (before 0.2.0) do not verify S3 bucket ownership for the scan-input bucket, whose name is derived from a publicly known account ID. An attacker who pre-registers that bucket can obtain the private source archive of a scanned workspace, including credentials and infrastructure state.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","aws","aws-security-agent","devsecops","lab-disclosure","mcp","s3"],"not_affected_if":["fixed-version","not-using-security-agent"],"how_to_check":"- Check the installed plugin or server version: `agent-toolkit-for-aws` and `awslabs.security-agent-mcp-server` should both be at `0.2.0` or later; affected are `<=1.0.0` for the plugin and `>=0.1.0 AND <=0.1.5` for the MCP server.\n- Verify the scan-input bucket `security-agent-scans-<account identifier>` exists and is owned by your own account.","fix":"- Upgrade `agent-toolkit-for-aws` and `awslabs.security-agent-mcp-server` to `0.2.0` or later, and patch any forked or derivative code.\n- Confirm the scan-input bucket `security-agent-scans-<account identifier>` is owned by your account; upgrading does not release a name already registered by someone else.\n- As a precaution, pre-create that bucket in your own account before first use.","status":"open","published_at":null,"first_seen_at":"2026-10-24T20:05:36+00:00","triaged_at":"2026-10-25T04:50:11+00:00","updated_at":"2026-10-25T04:50:11+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T04:50:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `agent-toolkit-for-aws` and `awslabs.security-agent-mcp-server` to `0.2.0` or later, and patch any forked or derivative code.\n- Confirm the scan-input bucket `security-agent-scans-<account identifier>` is owned by your account; upgrading does not release a name already registered by someone else.\n- As a precaution, pre-create that bucket in your own account before first use.","reach":"internet","title":"AWS Security Agent plugin and MCP server leak scanned workspace archives via bucket squatting","impact":"high","summary":"The AWS Security Agent plugin for aws-agents-for-devsecops (before 1.1.0) and its MCP server (before 0.2.0) do not verify S3 bucket ownership for the scan-input bucket, whose name is derived from a publicly known account ID. An attacker who pre-registers that bucket can obtain the private source archive of a scanned workspace, including credentials and infrastructure state.","category":"ai-tooling","nicknames":[],"who_cares":["aws","aws-security-agent","mcp","devsecops","s3"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker reads scanned source archives, including credentials and infrastructure state","analyst_note":"","how_to_check":"- Check the installed plugin or server version: `agent-toolkit-for-aws` and `awslabs.security-agent-mcp-server` should both be at `0.2.0` or later; affected are `<=1.0.0` for the plugin and `>=0.1.0 AND <=0.1.5` for the MCP server.\n- Verify the scan-input bucket `security-agent-scans-<account identifier>` exists and is owned by your own account.","needs_analyst":false,"not_affected_if":["fixed-version","not-using-security-agent"],"who_is_affected":"Teams that run the AWS Security Agent plugin for aws-agents-for-devsecops or its MCP server to scan workspaces, since scanned source archives are uploaded to a predictable S3 bucket. Exposure depends on the bucket name being registered by another account, so teams on the fixed versions still need to verify bucket ownership. unknown for teams that do not use these components.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000822,"input_tokens":4239,"output_tokens":797,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105':173C '-2026':2A,6A,117C,121C,144C,148C,214C,282C,455C,458C '-87912':3A,118C,145C,215C,456C '-87913':7A,122C,149C,283C,459C '0.1.0':343C '0.1.5':345C '0.2.0':70B,299C,365C '08':185C '09/10/2026':184C '1.0.0':342C '1.1.0':64B,238C '2026':172C '2px6':462C '30':186C '3g5x':464C '3jxw':30A,35A,467C '8x77':32A,37A,469C 'account':91B,277C,338C,418C,424C,438C,452C 'acknowledg':470C 'address':351C 'agent':17A,22A,45B,55B,60B,132C,137C,159C,164C,192C,227C,233C,295C,354C,361C,414C 'agent-mcp-serv':360C 'agent-toolkit-for-aw':353C 'ai':39B,201C 'ai-pow':200C 'ai-tool':38B 'allow':240C,301C 'alreadi':400C 'amazon':230C 'anoth':451C 'archiv':106B,248C,261C,309C,322C 'attack':94B,242C,303C 'attent':181C 'aw':15A,21A,41B,43B,53B,59B,130C,136C,157C,163C,174C,176C,190C,196C,225C,232C,293C,357C 'aws-agents-for-devsecop':20A,58B,135C,162C,231C 'aws-security-ag':42B 'aws-security@amazon.com':497C 'awslabs.security':359C 'bucket':10A,75B,82B,100B,125C,152C,220C,268C,288C,329C,393C,411C,434C 'bulletin':170C 'cannot':447C 'claud':477C 'code':203C,379C 'cohen':478C 'collabor':486C 'concern':503C 'contain':258C,319C 'content':177C 'coordin':491C 'creat':432C 'credenti':112B,254C,315C 'cve':1A,5A,116C,120C,143C,147C,213C,281C,454C,457C 'date':183C 'deriv':86B,272C,333C,378C 'descript':189C 'devsecop':24A,46B,62B,139C,166C,235C 'disclosur':49B,493C 'email':496C 'ensur':374C 'first':440C 'fix':386C 'fork':376C 'ghsa':29A,34A,461C,466C 'ghsa-2px6-hhjp-3g5x':460C 'ghsa-3jxw-vj8m-8x77':28A,33A,465C 'glow.io':480C 'hhjp':463C 'id':92B,171C 'identifi':212C,278C,280C,339C 'impact':340C 'import':179C 'includ':111B,253C,314C 'incorpor':383C 'infrastructur':114B,256C,317C 'input':81B,410C 'issu':348C,484C 'known':90B,276C,337C 'lab':48B 'lab-disclosur':47B 'latest':371C 'like':473C 'manag':195C 'mcp':26A,50B,67B,141C,168C,296C,362C 'might':239C,300C 'miss':8A,123C,150C,218C,286C 'model':207C 'nadav':476C 'name':84B,270C,331C,394C,446C 'new':385C 'obtain':102B,244C,305C 'own':420C 'ownership':11A,76B,126C,153C,221C,289C 'parti':398C 'patch':381C 'pdt':188C 'penetr':209C 'pleas':495C 'plugin':18A,56B,133C,160C,228C 'power':202C 'pre':97B,265C,326C,431C 'pre-creat':430C 'pre-regist':96B,264C,325C 'precaut':427C 'predict':445C 'privat':104B,246C,307C 'process':494C 'provid':199C 'public':89B,182C,275C,336C 'question':501C 'recommend':367C,403C 'refer':453C 'regist':98B,266C,327C,401C,449C 'releas':391C 'remot':241C,302C 'report':482C 'requir':180C 'resolut':346C 'review':205C 's3':9A,51B,74B,124C,151C,219C,287C 'scan':80B,109B,251C,312C,409C,415C 'scan-input':79B,408C 'scope':175C 'secur':16A,44B,54B,131C,158C,191C,204C,226C,294C,413C,500C 'security-agent-scan':412C 'server':27A,68B,142C,169C,297C,363C 'servic':197C 'sourc':105B,247C,308C 'state':115B,257C,318C 'storag':267C,328C 'test':210C 'thank':475C 'third':397C 'threat':206C 'tool':40B 'toolkit':355C 'type':178C 'upgrad':368C,388C 'us':488C 'use':441C 'verif':12A,127C,154C,222C,290C 'verifi':73B,406C 'version':237C,341C,364C,372C 'via':262C,323C 'vj8m':31A,36A,468C 'vulner':492C 'whose':83B,269C,330C 'workaround':387C 'workspac':110B,252C,313C 'would':472C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the AWS Security Agent plugin for aws-agents-for-devsecops or its MCP server to scan workspaces, since scanned source archives are uploaded to a predictable S3 bucket. Exposure depends on the bucket name being registered by another account, so teams on the fixed versions still need to verify bucket ownership. unknown for teams that do not use these components.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/#GHSA-3jxw-vj8m-8x77","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T20:05:36+00:00","fetched_at":"2026-10-24T20:05:36+00:00","note":"AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server"}],"documents":[{"id":2972,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/","title":"AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server","kind":"advisory","source":"lab","text":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\n### CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\nBulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT\n\nDescription:\n\nAWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.\n\nWe identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nWe identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nImpacted versions:\n\n- <=1.0.0\n- >=0.1.0 AND <=0.1.5\n\nResolution:\n\nThis issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nUpgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.\n\nReferences:\n\n- CVE-2026-87912\n- CVE-2026-87913\n- GHSA-2px6-hhjp-3g5x\n- GHSA-3jxw-vj8m-8x77\n\nAcknowledgement:\n\nWe would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}